Sign-in and access
Sentinel is not open to the public. Approved installers sign in with their work email, secured by Cloudflare Access — there is no self-serve signup. Ron approves each installer and can disable an account at any time from an admin console, so every live session belongs to a known, currently-approved engineer.
The audit log
Sentinel is read-only by default. When an engineer requests a write, the command is recorded to a tamper-evident audit log before it is relayed to the inverter:
- Append-only and hash-chained per system — each entry links to the one before it, so no engineer can alter, delete or reorder a record after the fact without breaking the chain. Only the account owner can erase an entire system's record (for example to clear a test), and every erasure is itself permanently logged.
- Logged before relay — the write is written to the log first; only then is the command passed on to the agent and the inverter.
- Fail-closed — if the change cannot be recorded, it is refused. No log, no write.
- Keyed to the engineer and the system — every entry records which signed-in engineer made the change and which system it targeted.
Separately, and enforced on the customer's own device, each write requires the customer to allow it during an engineer-armed access window — the agent refuses any write outside that window. (The customer's on-device approval is enforced by the agent; capturing that approval inside the audit log itself is planned but not yet in place, so we don't claim the log proves it.)
Report a vulnerability
If you believe you have found a security vulnerability in Sentinel — the agent, the cloud API, the dashboard, the pairing flow, or any other surface — please email hello@sentinelapp.solar with subject line beginning "SECURITY:".
Include enough detail for us to reproduce — affected version, steps to reproduce, expected vs actual behaviour, and what you believe the impact is. PGP-encrypted reports welcome on request.
What we promise
- Acknowledgement within 2 business days.
- Initial assessment within 5 business days.
- Coordinated disclosure timeline agreed in writing.
- No legal action against good-faith reporters who follow this policy.
- Public credit (with your permission) once a fix has shipped.
Scope
In scope: sentinelapp.solar, the Sentinel agent (all distribution channels), the Cloudflare Worker / Durable Object infrastructure, the pairing flow, and any official Sentinel mobile or desktop client.
Out of scope: social engineering, physical attacks, denial-of-service tests against production infrastructure, attacks against third-party services (Cloudflare, etc.) that we depend on.
Safe-harbour
If you make a good-faith effort to comply with this policy during your research, we will consider your research authorised, work with you to understand and resolve the issue quickly, and not pursue legal action against you. If a third party (e.g. law enforcement) initiates action while you are complying with this policy, we will make our position clear.
Last updated 01 July 2026.
